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Location of subscriber terminal in packet -switched radio sys- 
tem 

FIELD „ 

[0001] The invention relates to a method of performing a function of 
the subscriber terminal location service in a packet-switched radio system, and 
to a packet-switched radio system employing the method. 

BACKGROUND 

[0002] Location of a subscriber terminal, i.e. determination of the 
geographical location of a subscriber terminal, is an important function in cellu- 
lar radio networks. In the United States a federal authority (Federal Communi- 
cation Commission FCC) requests that one should be able to locate all sub- 
scriber terminals that make emergency calls even with accuracy of 50 meters. 
Location can also be used for commercial purposes, e.g. for defining various 
tariff areas or for implementing a navigation service which guides the user. So 
far the location service (LCS) has been mainly developed for circuit-switched 
cellular radio networks, such as the GSM system (Global System Mobile 
Communications). 

- [0003] Various methods are used for implementing the location ser- 
vice. At the least accurate level the location of a subscriber terminal can be 
determined on the basis of the identity of the cell that serves the subscriber 
terminal. This does not provide very accurate information because the diame- 
ter of a cell can be dozens of kilometers. 

[0004] A more accurate result is obtained by using timing informa- 
tion on the radio connection as additional information, e.g. the timing advance 
TA. In the GSM system the TA provides the location of a subscriber terminal 
with accuracy of approximately 550 meters. The problem is that if the cell is 
implemented with an omnidirectional antenna, the location of a subscriber ter- 
minal with respect to a base station is known only on the circumference drawn 
around the base station. A base station divided into three sectors, for example, 
slightly improves the situation, but even in that case it can only be determined 
that the subscriber terminal is located in a 120° sector in an area with a depth 
of 550 metres at a certain distance from the base station. 

[0005] These inaccurate methods are adequate for some applica- 
tions, e.g. for determining tariff areas. More accurate methods have also been 
developed. These methods are usually based on various base stations meas- 
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uring a signal transmitted by a subscriber terminal. One example of such 
methods is the TOA method (Time of Arrival). 

[0006] The subscriber terminal can also measure signals transmit- 
ted by various- base stations. An example of such a method is the-E-OTD 
5 method (Enhanced Observed Time Difference). In synchronized networks the 
subscriber terminal measures the ratios between the reception moments of the 
signals it has received from different base stations. In non-synchronized net- 
works the signals transmitted by the base stations are also received by a loca- 
tion measurement unit LMU placed at a known and fixed measurement point, 

10 The location of the subscriber terminal is determined on the basis of geometri- 
cal components obtained from time delays. 

[0007] Another location method is to use a GPS receiver (Global 
Positioning System) arranged in a subscriber terminal. The GPS receiver re- 
ceives a signal transmitted by at least four earth-orbiting satellites, and the lati- 

15 tude, longitude and altitude of the location of the subscriber terminal can be 
calculated on the basis of these signals. The subscriber terminal either deter- 
mines the location independently or it is assisted in the determination. The 
network part of the radio system may send an assistance message to the sub- 
scriber terminal, which speeds up the location process, i.e. the power con- 

20 sumption of the subscriber terminal decreases. The assistance message may 
contain the time, a list of visible satellites, Doppler shift of the satellite signal 
and a search window for the code phase. The subscriber terminal can send the 
information it has received to the network part, in which the location is calcu- 
lated. In this application the network part of the radio system refers to the fixed 

25 part of the radio system, i.e. to the whole system except for the subscriber ter- 
minal. 

[0008] In packet-switched radio systems, like in the GPRS (General 
Packet Radio Service) or in the EGPRS (Enhanced General Packet Radio 
Service), very little attention has been paid to the implementation of the loca- 

30 tion service. The EGPRS is a GSM-based (Global System for Mobile Commu- 
nications) system which utilizes packet-switched transmission. The EGPRS 
employs the EDGE (Enhanced Data Rates for GSM Evolution) technique for 
increasing the data transmission capacity. In addition to the GMSK modulation 
(Gaussian Minimum-Shift Keying) normally used in the GSM, the 8-PSK modu- 

35 lation (8-Phase Shift Keying) can also be applied to packet data channels. The 
main object is to provide non-real-time data transmission services, such as 




copying of files and use of an Internet browser, but also packet-switched real 
time services for transmission of speech and video, for example. 

[0009] In packet-switched radio systems the location methods de- 
scribed above require a packet-switched transmission connection between the 
5 core network of the radio system and the subscriber terminal for transmitting 
the necessary information. The signaling traffic needed is rather heavy and 
slow. In time critical applications it would, however, be important to receive the 
location of the subscriber terminal fast from the location service. 

BRIEF DESCRIPTION OF THE INVENTION 

.10 [0010] An object of the invention is to provide an improved method 

of performing a function of the subscriber terminal location service in a packet- 
switched radio system. According to an aspect of the present invention, there 
is provided a method of claim 1 of locating a subscriber terminal in a packet- 
switched radio system. According to another aspect of the invention, there is 

15 provided a packet-switched radio system of claim 18. The preferred embodi- 
ments of the invention are disclosed in the dependent claims. 

[0011] The invention is based on adding information needed by a 
function of the location service to a request message or to a new response 
message. 

20 - [0012] Several improvements are achieved with the method and 

apparatus of the invention: the location method becomes faster, in certain 
cases no packet-switched transmission connection needs to be established at 
all, and the amount of signaling needed decreases. 

BRIEF DESCRIPTION OF THE DRAWINGS 
25 [0013] The invention will be described in greater detail by means of 

preferred embodiments with reference to the accompanying drawings, in which 
[0014] Figure 1 A shows an example of the structure of a cellular ra- 
dio network; 

[0015] Figure 1B is a block diagram illustrating the cellular network 
30 in greater detail; 

[0016] Figure 1C illustrates a circuit-switched connection; 
[0017] Figure 1D illustrates a packet-switched connection; 
[0018] Figure 2 shows an example of protocol stacks used in certain 
parts of the cellular radio network; 
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[0019] Figure 3 is a flow chart illustrating a method of performing a 
function of the subscriber terminal location service; 

[0020] Figure 4 is a signal sequence chart related to Figure 3 illus- 
trating an example of the performance of the location function. 

5 DESCRIPTION OF EMBODIMENTS 

[0021] The typical structure of a packet-switched radio system and 
its connections to a public switched telephone network and packet transmis- 
sion network will be described with reference to Figures 1A and 1B. Figure 1B 
includes only the blocks necessary for describing the embodiments, but it is 

10 clear to a person skilled in the art that a conventional packet-switched cellular 
radio network also comprises other functions and structures that need not be 
described in greater detail here. The radio system may be e.g. the GSM-based - 
GPRS or EGPRS system, the universal mobile telephone system UMTS, 
which utilizes the wideband code division multiple access method, or an inter- 

15 mediate form of these systems, in which the structure of the radio network is 
similar to that of the UMTS and which is called e.g. GERAN (GSM Enhanced 
Radio Access Network). In such a system the radio interface is, however, a 
normal GSM-based radio interface or a radio interface which uses EDGE 
modulation. 

20 [0022] The description of Figures 1 A and 1 B is mainly based on the 

UMTS. The main parts of the mobile communications system are a core net- 
work CN, an UMTS terrestrial radio access network, i.e. the radio network UT- 
RAN, and user equipment UE. The interface between the CN and the UTRAN 
is called lu, and the air interface between the UTRAN and the UE is known as 

25 Uu. 

[0023] The UTRAN consists of radio network subsystems RNS. The 
interface between the RNSs is called lur. The RNS consists of a radio network 
controller RNC and of one or more B nodes. The interface between the RNC 
and the B is called lub. The coverage area of the B node, i.e. a cell, is marked 

30 with C is Figure 1B. The more conventional name, i.e. base station system 
BSS, can also be used for the RNS. The network part of the radio system thus 
comprises the radio network UTRAN and the core network CN. 

[0024] The illustration of Figure 1A is very abstract, and thus it is 
specified in Figure 1B by showing which part of the GSM system approxi- 

35 mately corresponds to which part of the UMTS. It should be noted that the de~ 
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scription is not limiting but only indicative because the responsibilities and 
functions of the different parts of the UMTS are still under design. 

[0025] The subscriber terminal 150. may be fixed, placed in a vehi- 
cle or a portable terminal. The infrastructure of the radio network UTRAN con- 
5 sists of radio network subsystems RNS, i.e. base station systems. The radio 
network subsystem RNS consists of radio network controllers RNC, i.e. of a 
base station controller 102 and of at least one B node, i.e. a base station 100, 
controlled by it, 

[0026] The base station B contains a multiplexer 116, transceivers 
10 114 and a control unit 118, which controls the function of the transceivers 114 
and the multiplexer 116. The multiplexer 116 is used for arranging the traffic 
and control channels used by several transceivers 114 on one transmission 
connection 160. 

[0027] From the transceivers 114 of the base station B there is a 

15 connection to an antenna unit 112, which establishes a bi-directional radio 
connection Uu to the subscriber terminal 150. The structure of the frames to be 
transmitted on the bi-directional radio connection Uu is strictly defined. 

[0028] The base station controller RNC comprises a switching field 
120 and a control unit 124. The switching field 120 is used for switching 

20 speech and data and for connecting signaling circuits. A base station system 
formed by the base station B and the base station controller RNC also includes 
a transcoder 122. The division of tasks between the base station controller 
RNC and the base station B and the physical structure may vary according to 
the application. Typically the base station B implements the radio path as de- 

25 scribed above. The base station controller RNC is typically responsible for the 
following: radio resource management, handover control, power control, tim- 
ing, synchronization and paging of a subscriber terminal. 

[0029] The transcoder 122 is usually located as close to a mobile 
services switching center -132 as possible because this saves transmission 

30 capacity when speech is transmitted in the format of a cellular radio network 
between the transcoder 122 and the base station controller RNC. The 
transcoder 122 converts the different digital speech encoding formats used 
between the public switched telephone network and the radio telephone net- 
work into a compatible format, e.g. from the 64 kbits/s format of the fixed net- 

35 work into a format of the cellular radio network (e.g. 13 kbit/s), and vice versa. 
The devices needed are not described in greater detail here, but it should be 
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noted that other data than speech are not converted in the transcoder 122. 
The control unit 124 is responsible for call controlling, mobility management, 
collection of statistics and signaling. 

[0030] The core network CN consists of infrastructure belonging to 
5 a mobile communications system external to the UTRAN. Figure 1B illustrates 
a mobile services switching center 132, which is one of the devices belonging 
to circuit-switched transmission of the core network CN. 

[0031] As is seen in Figure 1B, the switching field 120 can establish 
connections (illustrated with black dots) both to a public switched telephone 

10 network PSTN 134 via the mobile services switching center 132 and to a 
packet transmission network 142. In the public switched telephone network 
134 a typical terminal 136 is a conventional telephone or an ISDN telephone 
(Integrated Services Digital Network). Packet transmission is performed from a 
computer 148 connected to the mobile communication system via the Internet 

15 146 to a portable computer 152 connected to the subscriber terminal 150. A 
WAP phone (Wireless Application Protocol) can also be used instead of the 
combination of the subscriber terminal 150 and the portable computer 152. 

[0032] The connection between the packet transmission network 
142 and the switching field 120 is established by a support node 140 (SGSN = 

20 Serving GPRS Support Node). The function of the support node 140 is to 
transmit packets between the base station system and a gateway node (GGSN 
= Gateway GPRS Support Node) 144 and keep a record of the location of the 
subscriber terminal 150 in its area. 

[0033] The gateway node 144 connects a public packet transmis- 

25 sion network 146 and the packet transmission network 142. An Internet proto- 
col or an X.25 protocol can be used at the interface. The gateway node 144 
hides the internal structure of the packet transmission network 142 from the 
public packet transmission network 146 by encapsulating the structure, and 
thus the public packet transmission network 146 regards the packet transmis- 

30 sion network 142 as a sub-network which comprises a subscriber terminal 150 
to which the public packet transmission can send packets and receive packets 
from it. 

[0034] The packet transmission network 142 is typically a private 
. network which utilizes the Internet protocol and carries signaling and user data. 
35 The structure of the network 142 may vary according to the operator in respect 
of its architecture and protocols below the Internet protocol layer. 
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[0035] The public packet transmission network 146 may be e.g. the 
worldwide Internet network, there being a terminal 148, e.g. a server computer, 
connected to the Internet which wants to transmit packets to the subscriber 
terminal 150. 

5 [0036] Figure 1C illustrates how a circuit-switched connection is es- 

tablished between the subscriber terminal 150 and the terminal 136 of the pub- 
lic switched telephone network. The bold line in the figures illustrates how data 
passes through the system at the air interface 170 from the antenna 1 12 to the 
transceiver 114 and from the transceiver in a form multiplexed in the multi- 

10 plexer 116 over a transmission connection 160 to the switching field 120, 
where a connection is established to the output towards the transcoder 122, 
and further to the terminal 136 connected to the public switched telephone 
network 134 through switching performed at the mobile services switching cen- 
ter 132. In. the base station 100 the control unit 118 controls the multiplexer 

15 116 in performing of transmission, and in the base station controller 102 the 
control unit 124 controls the switching field 120 in performing of correct switch- 
ing. 

[0037] Figure 1D illustrates a packet-switched transmission connec- 
tion. A portable computer 152 is connected to the subscriber terminal 150. The 

20 bold line describes how the data to be transmitted is carried from the server 
computer 148 to the portable computer 152. Information can naturally also be 
transmitted in the opposite transmission direction, that is, from the portable 
computer 152 to the server computer 148. Data passes through the system at 
the air interface, i.e. at the Urn interface 170, from the antenna 112 to the 

25 transceiver 114 and from the transceiver in a form multiplexed in the multi- 
plexer 116 over a transmission connection 160 at the Abis interface to the 
switching field 120, where a connection is established to the output towards 
the support node 140 at the Gb interface. From the support node 140 the data 
is transmitted along the packet transmission network 142 via the gateway node 

30 144 to the server computer 148 connected to the public packet transmission 
network 146. 

[0038] For the sake of clarity Figures 1C and 1D do not illustrate a 
case in which both circuit-switched and packet-switched data are transmitted 
at the same time. This is, however, feasible as well as common since capacity 
35 freed from transmission of circuit-switched data can be flexibly used for packet- 
switched transmission. It is also possible to build a network on which only 
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packet-switched data is transmitted, i.e. no circuit-switched data. In that case 
the network structure can be simplified. 

[0039] We will now return to Figure 1D. The different entities of the 
UMTS system, i.e. CN, UTRAN, RNS, RNC, B, are illustrated with broken line 
5 boxes in the figure. Devices of the core network CN that belong to packet- 
switched transmission will also be described in greater detail. In addition to the 
support node 140, packet transmission network 142 and gateway node 144, 
the core network comprises a gateway mobile location center GMLC 186 and a 
home location register HLR 184. The function of the gateway mobile location 

10 center is to offer the requested service to an outside client 188 of the location 
service. The home location register 184 includes subscriber data of the loca- 
tion service and routing information. 

[0040] Figure 1D shows a serving mobile location center 182, which 
is one of the devices needed by the location service and may be located, as 

15 shown, in the base station controller RNC, e.g. in its control part 124, or which 
may be a separate device connected either to the base station controller RNC 
or to the support node 140. The figure also shows a location measurement unit 
LMU 180, which may be in the base station B, e.g. in its control part 118, or 
which may be a separate device connected to the base station B. The function 

20 of the location measurement unit 180 is to perform any radio measurements 
needed in the location method. 

[0041] Figure 1D also shows those structural parts of the subscriber 
terminal UE that are relevant to the present embodiment. The subscriber ter- 
minal UE comprises an antenna 190, via which a transceiver 192 receives a 

25 signal from the radio path 170. The function of the subscriber terminal UE is 
controlled by a control part 194, which is typically a microprocessor provided 
with the necessary software. The protocol procedures to be described later are 
also performed by this software. In addition to the above-mentioned parts, the 
subscriber terminal UE comprises a user interface, which typically consists of a 

30 loudspeaker, microphone, screen and keyboard, and a battery. These are not 
described more closely because they are irrelevant to the present invention. 

[0042] Neither the structure of the transceiver in the base station B 
nor t the structure of the transceiver in the subscriber terminal UE is described 
more closely because it is clear to a person skilled in the art how these devices 

35 are implemented. For example, a normal radio network transceiver and a sub- 
scriber terminal transceiver in accordance with the EGPRS can be used. The 
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only thing that is important to the present embodiment is that the radio connec- 
tion 170 can be implemented, since the function required by the application is 
performed at upper levels of the OSI model (Open Systems Interconnection), 
particularly in the third layer. 
5 [0043] Figure 2 illustrates control plane protocol stacks of the 

EGPRS. It should be noted that the embodiments are not limited to the 
EGPRS. The protocol stacks have been formed according to the OSI model 
(Open Systems Interconnection) of the ISO (International Standardization Or- 
ganization). In the OSI model protocol stacks are divided into layers. In princi- 

10 pie, there may be seven layers. Figure 2 shows which protocol sections are 
processed in each network element. The network elements illustrated in the 
figure are a subscriber terminal MS, a base station system BSS, a support 
node SGSN and a gateway node GGSN. The base station and the base sta- 
tion controller are not illustrated separately because an interface has not been 

15 defined between them. In principle, the protocol handling defined for the base 
station system BSS can be divided freely between the base station 100 and 
the base station controller 102, but in practice not between the transcoder 122, 
even though it belongs to the base station system BSS. Different network ele- 
ments are separated by interfaces Urn, Gb and Gn between them. 

20 [0044] The layer in each device MS, BSS, SGSN, GGSN communi- 

cates logically with a layer in another device. Only the lowest physical layers 
communicate directly with one another. The other layers always use the ser- 
vices provided by the next lower layer. Thus a message has to physically travel 
in the vertical direction between the layers, and only in the lowest layer the 

25 message travels in the horizontal direction between the layers. 

[0045] The actual bit-level data are always transmitted using the 
first physical layer RF, L1. The mechanical, electric and functional properties 
needed to access a physical transmission path are defined in the physical 
layer. The second layer, i.e. the data link layer, uses the services of the physi- 

30 cal layer to provide reliable data transmission, and corrects e.g. transmission 
errors. At the air interface 170 the data link layer is divided into an RLC/MAC 
sub-layer and an LLC sub-layer. The third layer, i.e. the network layer, pro- 
vides the upper layers with independence from data transmission and switch- 
ing techniques, which are used for establishing a connection between the de- 

35 vices. The network layer is responsible for establishment, maintenance and 
release of a connection, for example. In the GSM the network layer is also 
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called a signaling layer. It has two main functions: it routes messages and en- 
ables several independent connections between two entities at the same time. 

[0046] The network layer comprises a session management SM 
sub-layer and a GPRS mobility management GMM sub-layer. 
5 [0047] The mobility management sub-layer GMM takes the conse- 

quences that result from the fact that the user of the subscriber terminal moves 
and are not directly related to the management of radio resources. In the fixed 
network this sub-layer would check the user's rights and connect the user to 
the network. In cellular radio networks this sub-layer thus supports user mobil- 

10 ity, registration and management of mobility data. This sub-layer also checks 
the identity of the subscriber terminal and the identities of allowed services. In 
this sub-layer messages are transmitted between the subscriber terminal MS 
and the support node SGSN. 

[0048] The session management sub-layer SM manages all func- 

15 tions related to the management of a packet-switched call but it does not de- 
tect user mobility. The session management sub-layer SM establishes, main- 
tains and releases connections. It has separate procedures for calls originating 
from the subscriber terminal 150 and for calls terminating to the subscriber 
terminal. In this sub-layer messages are also transmitted between the sub- 

20 scriber terminal MS and the support node SGSN. 

[0049] In the base station system BSS the messages of the session 
management sub-layer SM and the mobility management sub-layer GMM are 
processed transparently, i.e. they are only transferred to and fro. 

[0050] The LLC layer (Logical Link Control) provides a reliable logi- 

25 cat encryption link between the SGSN and the MS. The LLC is independent of 
the lower layers, which allows to minimize the effect of changes in the air inter- 
face on the network part of the mobile communications network. The informa- 
tion to be transmitted and the user data are encrypted. Between the Urn and 
the Gb interfaces the LLC data is transmitted at the relaying level LLC RELAY 

30 of the LLC. 

[0051] The MAC level (Medium Access Control) is responsible for 
the following tasks: multiplexing of data and signaling both in the uplink (from 
the subscriber terminal towards the network part) and in the downlink (from the 
networks part towards the subscriber terminal), management of resource re- 
35 quests in the uplink and allocation of resources and timing of traffic in the 
downlink. Management of traffic prioritization also belongs to this level. The 
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RLC level (Radio Link Control) transmits data of the LLC level, i.e. LLC frames, 
to the MAC level; the RLC splits the LLC frames into RLC data blocks, which it 
transmits to the MAC layer. In the uplink direction the RLC forms LLC frames 
from the-RLC data blocks and transmits them to the LLC layer.- The physical 
5 level is implemented with a radio connection at the Um interface, e.g. at the air 
interface defined for the GSM. At the physical level the following tasks, for ex- 
ample, are performed: modulation of the carrier wave, interleaving and error 
correction of the data to be transmitted, synchronization, and power control of 
the transmitter. 

10 [0052] The GPRS tunneling protocol GTP tunnels the signaling 

along the trunk network between different SGSNs and GGSNs. If desired, the 
GTP can control the flow between the SGSN and the GGSN. 

[0053] The user datagram protocol UDP transmits the GTP layer 
data packets whose protocol does not require a reliable link, e.g. when the 

15 Internet protocol IP is used. At the user level a TCP (Transmission Control Pro- 
tocol) could also be used, which controls the flow of the packets transmitted via 
it and protects them against disappearance and corruption. The UPD protects 
the packets only against corruption. 

[0054] The IP is a trunk network protocol of the GPRS, which routes 

20 user data and control data. The IP may be based on the IPv4 protocol," but in a 
later phase this will be replaced with the Ipv6 protocol. - 

[0055] In addition to the upper level data, the BSSGP plane (Base 
Station Subsystem GPRS Protocol) carries information on routing and quality 
of service between the BSS and the SGSN. This information is physically car- 

25 ried by the FR level (Frame Relay). The NS (Network Service) transmits the 
messages in accordance with the BSSGP protocol. 

[0056] In the following, we will exemplify with reference to Figures 3 
and 4 how a function of the subscriber terminal location service is performed 
when the subscriber terminal requests it. Figure 3 is a flow chart illustrating the 

30 functions to be performed in the basic method, and Figure 4 is a signal se- 
quence chart illustrating different embodiments of the method. 

[0057] The method starts in block 300. In block 302 the subscriber 
terminal MS sends a request message 400 for location service via the radio 
network, which is the base station system BSS in our example, to the core 

35 network, which is the support node SGSN in our example. If desired, security 
procedures can be performed after this, e.g. identification of the subscriber 
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terminal, according to the prior art. For the sake of clarity, these security pro- 
cedures are not shown in Figures 3 and 4. 

[0058] Next at least one function of the location service requested in 
the-message 400 is performed according to block 304. The request message 
5 relates to one of the following location service functions: determination of the 
subscriber terminal location, informing an outside client of the radio system of 
the subscriber terminal location, transmission of location assistance data to the 
subscriber terminal, or transmission of a ciphering key for decrypting the loca- 
tion assistance data to the subscriber terminal. 

10 [0059] Determination of the subscriber terminal location means that 

the geographical location of the subscriber terminal is found out and given as 
longitude or latitude, for example. The location is needed by the subscriber 
terminal, i.e. its user, or by an outside client of the location service in the radio 
system. The route traveled by the subscriber terminal is traced so that the sub- 

15 scriber terminal at regular intervals sends a message to the core network re- 
questing determination of the location of the subscriber terminal. 

[0060] The location assistance data refers e.g. to the assistance 
message which was described at the beginning and includes information on 
how the GPS system can be used more efficiently. Such assistance messages 

20 can be sent oh the broadcast channel of the system and their use is charge- 
able. For this reason, the assistance messages can be encrypted, in which 
case the subscriber terminal has to request a ciphering key for decrypting the 
messages from the network. 

[0061] Information of various kinds can be inserted into the request 

25 message 400. The information included in the request message 400 comprises 
the identity of the serving cell, and/or timing information on the radio connec- 
tion and/or other information on the radio system or the subscriber terminal, 
and/or the desired quality of service of the requested location service, and/or 
the telecommunications address, e.g. the IP address, of the outside client who 

30 wants location information on the subscriber terminal. The timing information 
includes a timing advance factor or the round trip time. The other information 
that can be used includes at least one of the following parameters: receiving 
power of the serving cell, receiving power of at least one neighboring cell, 
charge level of the battery in the subscriber terminal, information on the condi- 

35 tions at the location of the subscriber terminal, such as the temperature, and 
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identity of a separate device connected to the subscriber terminal, such as the 
IP address. 

[0062] At least part of the information included in the request mes- 
sage received by the core network has been inserted into the request message 
5 by the subscriber terminal, and/or at least part of the information included in 
the request message received by the core network has been inserted into the 
request message by the radio network. 

[0063] When the desired function is location of the subscriber termi- 
nal, a special location procedure is performed. Figure 4 illustrates one example 

10 of how the location function can be performed. The support node SGSN sends 
a location request 402 to the base station subsystem BSS, which forwards this 
request 404 to the location center SMLC. The network part of the radio system, 
which is represented by the SMLC in our example, can locate the subscriber 
terminal on the basis of the information included in the request message, using 

15 e.g. the timing advance factor and the cell identity. 

[0064] According to block 406, the network part, i.e. the function in 
the SMLC in our example, checks whether the location of the subscriber termi- 
nal carried out corresponds to the target set for the quality of service. If the 
target set for the quality of service is not achieved, we will move to block 412 

20 according to arrow 410, where the network part performs a location service 
which provides a better quality of service. If the target set for the quality of ser- 
vice set is achieved, we will move to block 414 according to arrow 508, where 
a message 414 informing the base station system of the location of the sub- 
scriber terminal is sent, and the base station system forwards this information 

25 416 to the support node SGSN of the core network. 

[0065] Initiation of the location service in the subscriber terminal at 
the same time as the request message 400 is sent may further performance of 
the location service that provides a better quality of service in block 400. 
According to block 412, the communication needed is performed using a 

30 packet-switched connection between the SMLC, the BSS and the MS so that 
the location service with a better quality can be performed. The content of the 
messages concerned naturally depends on the location method used. The 
location methods described at the beginning, e.g. the TOA method or the E- 
OTD method, can be used, depending on which is supported by the radio 

35 system and the subscriber terminal. After the location with a better quality has 
been performed, we can return to block 406, where the quality of service is 
tested again. In principle, the quality of the location service can be improved 



- again. In principle, the quality of the location service can be improved with 
several iteration cycles. In the example of Figure 4 it is assumed that a suffi- 
cient quality of service is achieved with one iteration cycle, i.e. that if functions 
included in block- 41 2 have been performed, then we will move directly from 
5 block 412 to transmission of the location information message 414. 

[0066] The measures required by the location service with a better 
quality include reception of signals in the subscriber terminal, and measure- 
ment of the signals or transmission of signals from the subscriber terminal. For 
implementation of the location service, the signals to be received in the sub- 

10 scriber terminal also comprise signals transmitted by other base stations of the 
radio system than by that of the serving cell, or the signals transmitted by a 
satellite of the GPS system. 

- [0067] After the SGSN has received the message 416 including the 
location of the subscriber terminal, it transmits this information 418 to the 

1 5 GMLC, which sends an acknowledgement message 420. 

[0068] Next it is checked in the GMLC in block 422 whether an out- 
side client LCS CLIENT of the location service wants to have information on 
the location of the subscriber terminal. If an outside client wants the location 
information, we will move according to arrow 424 to transmission of the mes- 

20 sage 428 including the location information to the outside client. 

~ [0069] An outside client of the radio system is informed of the loca- 
tion of the subscriber terminal by the core network GMLC, by the subscriber 
terminal MS itself, or together by the core network GMLC and the subscriber 
terminal MS. The core network GMLC may independently inform an outside 

25 client of the location, provided that the GMLC database includes a valid order 
for this information. The subscriber terminal itself may also give the information 
to a desired outside party. In that case the subscriber terminal has to establish 
a normal packet-switched transmission connection for transmitting this infor- 
mation. Cooperation -between the GMLC and the subscriber terminal can be 

30 implemented e.g. so that the subscriber terminal gives the telecommunications 
address, e.g. the IP address, of the outside client who wants information on the 
subscriber terminal location in the request message 400, and having received 
the location information, the GMLC sends a message 418 including the loca- 
tion and the telecommunications address to the client. The message may also 

35 contain the identity of a separate device connected to the subscriber terminal, 
such as the IP address. 
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[0070] After the desired function or functions have been performed, 
the core network SGSN transmits a response message 430 to the request 
message 400 to the subscriber terminal via the radio network. Then the 
method is finished in block 308. The response message contains at least one 
5 of the following pieces of information: the location of the subscriber terminal, 
location assistance data, a ciphering key for decrypting the location assistance 
data, an error code, information on whether the subscriber terminal location 
information is to be supplied to an outside client. The request message and the 
response message are messages of the protocol layers that correspond to the 

1 0 third layer of the OSI model. 

[0071] Compared to the prior art, the new features are implemented 
preferably by software, and thus the location method requires relatively simple 
software changes to precisely defined functions in the core network, radio net- 
work and subscriber terminal. The subscriber terminal UE comprises means 

15 1 94 for transmitting a request message for location service to the core network 
CN via the radio network RAN. The core network CN comprises means for per- 
forming at least one of the functions required in the request message and 
means for transmitting a response message to the subscriber terminal UE via 
the radio network RAN. The means can also be implemented as software to be 

20 performed in a general-purpose processor. The invention can also be imple- 
mented by hardware, e.g. as an ASIC (Application Specific Integrated Circuit) 
or as control logic consisting of separate components. 

[0072] Even though the invention has bee described with reference 
to the example according to the accompanying drawings, it is clear that the 

25 invention is not limited thereto but may be modified in various ways within the 
inventive concept disclosed in the appended claims. 



